opendut
opendut copied to clipboard
Support mTLS for client authentication
It should be possible to host our backend on a server with mutual authentication as second-factor for authenticating a client (2FA).
Tasks:
- [ ] Configure Traefik in Localenv with mTLS enabled
https://doc.traefik.io/traefik/https/tls/#client-authentication-mtls
- [x] Depends on: #380
- [ ] Allow manual creation of client certificates via script in Localenv
- [ ] Perform test deployment of Localenv
- [ ] Test with client certificates from other CA
- [ ] Load mTLS certificate in EDGAR
- [ ] Check OpenTelemetry client works (backend should be covered by Traefik)
- [ ] Load mTLS certificate in CLEO
- [ ] Load mTLS certificate in NetBird client
NetBird likely supports mTLS in more recent versions: https://github.com/netbirdio/netbird/pull/2188
- [ ] Depends on: #378
- [ ] Check LEA works (should only need certificate installed in browser)
- [ ] Check Grafana works (should only need certificate installed in browser)